6.8
高危
56 个模型检测该样本为恶意！
重新分析
更多

dd9d76d4c35386a10fccd7db7a0e67a1d257c2bb09c36c30859c15ed90c86100

49bf96982edd9e0cd369bda928e7c1ac.exe

分析耗时

181s

最近分析

文件大小

372.5KB
静态报毒 动态报毒 A6YJYWPW58Q AI SCORE=84 ATTRIBUTE CLASSIC CONFIDENCE ELDORADO EMOTET FHDGP GENCIRC HDNU HDZF HIGH CONFIDENCE HIGHCONFIDENCE HLCPRD ICEDID KCLOUD KRYPTIK MALWARE@#2F819DOHXTN1Y PHOTODLDER R335693 SCORE SUSGEN TRICKBOT UNSAFE WACATAC XY1@AMQIEDE ZEXAF ZUSY 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Emotet-FQU!49BF96982EDD 20201211 6.0.6.653
Alibaba Trojan:Win32/Emotet.2578c1cc 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20201210 21.1.5827.0
Tencent Malware.Win32.Gencirc.10b9ecf5 20201211 1.0.0.1
Kingsoft Win32.Troj.Undef.(kcloud) 20201211 2017.9.26.565
CrowdStrike win/malicious_confidence_60% (W) 20190702 1.0
静态指标
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619464083.046875
GlobalMemoryStatusEx
success 1 0
The executable uses a known packer (1 个事件)
packer Armadillo v1.71
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features POST method with no referer header suspicious_request POST https://update.googleapis.com/service/update2?cup2key=10:2999497067&cup2hreq=c33cf192d73764709cec5d2e3050f63fe5e2f329a1ac6050adbcb8d10d4752b3
Performs some HTTP requests (7 个事件)
request GET http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
request HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request HEAD http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619489065&mv=m&mvi=1&pl=23&shardbypass=yes
request HEAD http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=33be3ccb6a911403&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619489065&mv=m
request GET https://support.microsoft.com/
request GET https://support.microsoft.com/socbundles/jsll
request POST https://update.googleapis.com/service/update2?cup2key=10:2999497067&cup2hreq=c33cf192d73764709cec5d2e3050f63fe5e2f329a1ac6050adbcb8d10d4752b3
Sends data using the HTTP POST Method (1 个事件)
request POST https://update.googleapis.com/service/update2?cup2key=10:2999497067&cup2hreq=c33cf192d73764709cec5d2e3050f63fe5e2f329a1ac6050adbcb8d10d4752b3
Allocates read-write-execute memory (usually to unpack itself) (1 个事件)
Time & API Arguments Status Return Repeated
1619464081.577875
NtAllocateVirtualMemory
process_identifier: 1760
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00480000
success 0 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619464130.077875
GetAdaptersAddresses
flags: 15
family: 0
failed 111 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Attempts to create or modify system certificates (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob
File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 个事件)
Elastic malicious (high confidence)
FireEye Gen:Variant.Zusy.302839
CAT-QuickHeal Trojan.Emotet
McAfee Emotet-FQU!49BF96982EDD
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Malware
K7AntiVirus Trojan ( 005661dc1 )
Alibaba Trojan:Win32/Emotet.2578c1cc
K7GW Trojan ( 005661dc1 )
Arcabit Trojan.Zusy.D49EF7
Cyren W32/Trickbot.DP.gen!Eldorado
Symantec ML.Attribute.HighConfidence
APEX Malicious
Avast Win32:Trojan-gen
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan-Banker.Win32.Emotet.gen
BitDefender Gen:Variant.Zusy.302839
NANO-Antivirus Trojan.Win32.IcedID.hlcprd
Paloalto generic.ml
MicroWorld-eScan Gen:Variant.Zusy.302839
Tencent Malware.Win32.Gencirc.10b9ecf5
Ad-Aware Gen:Variant.Zusy.302839
Sophos Mal/Generic-S
Comodo Malware@#2f819dohxtn1y
F-Secure Trojan.TR/AD.PhotoDlder.fhdgp
DrWeb Trojan.IcedID.28
Zillya Trojan.Kryptik.Win32.2012108
TrendMicro TrojanSpy.Win32.EMOTET.SMT.hp
McAfee-GW-Edition BehavesLike.Win32.Emotet.fm
Emsisoft Trojan.Emotet (A)
Ikarus Trojan-Banker.IcedID
Jiangmin Trojan.Banker.Emotet.nqm
Webroot W32.Trojan.Gen
Avira TR/AD.PhotoDlder.fhdgp
Kingsoft Win32.Troj.Undef.(kcloud)
Gridinsoft Trojan.Win32.Kryptik.ba
Microsoft Trojan:Win32/Emotet.DEK!MTB
AegisLab Trojan.Multi.Generic.4!c
ZoneAlarm HEUR:Trojan-Banker.Win32.Emotet.gen
GData Gen:Variant.Zusy.302839
AhnLab-V3 Trojan/Win32.Trickbot.R335693
BitDefenderTheta Gen:NN.ZexaF.34670.xy1@amqiedE
MAX malware (ai score=84)
VBA32 Trojan.Wacatac
Malwarebytes Trojan.Downloader
ESET-NOD32 a variant of Win32/Kryptik.HDZF
TrendMicro-HouseCall TrojanSpy.Win32.EMOTET.SMT.hp
Rising Trojan.Kryptik!1.C89F (CLASSIC)
Yandex Trojan.Kryptik!A6YJYwpw58Q
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)
dead_host 172.217.24.14:443
dead_host 216.58.200.238:443
dead_host 108.160.162.98:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-05-04 22:23:56

Imports

Library KERNEL32.dll:
• 0x449bd0 SetFileTime
• 0x449bd4 SetFileAttributesA
• 0x449be0 RtlUnwind
• 0x449be4 GetStartupInfoA
• 0x449be8 GetCommandLineA
• 0x449bec ExitProcess
• 0x449bf0 TerminateProcess
• 0x449bf4 HeapFree
• 0x449bf8 CreateThread
• 0x449bfc ExitThread
• 0x449c00 HeapAlloc
• 0x449c04 RaiseException
• 0x449c08 HeapReAlloc
• 0x449c0c HeapSize
• 0x449c10 GetACP
• 0x449c18 GetSystemTime
• 0x449c1c GetLocalTime
• 0x449c34 SetHandleCount
• 0x449c38 GetStdHandle
• 0x449c40 HeapDestroy
• 0x449c44 HeapCreate
• 0x449c48 VirtualFree
• 0x449c4c FatalAppExitA
• 0x449c50 VirtualAlloc
• 0x449c54 IsBadWritePtr
• 0x449c58 LCMapStringA
• 0x449c5c LCMapStringW
• 0x449c64 GetStringTypeA
• 0x449c68 GetStringTypeW
• 0x449c6c Sleep
• 0x449c70 IsBadReadPtr
• 0x449c74 IsBadCodePtr
• 0x449c78 IsValidLocale
• 0x449c7c IsValidCodePage
• 0x449c80 GetLocaleInfoA
• 0x449c84 EnumSystemLocalesA
• 0x449c88 GetUserDefaultLCID
• 0x449c8c GetVersionExA
• 0x449c94 SetStdHandle
• 0x449c98 CompareStringA
• 0x449c9c CompareStringW
• 0x449ca4 GetLocaleInfoW
• 0x449ca8 GetFileTime
• 0x449cac GetFileSize
• 0x449cb0 GetFileAttributesA
• 0x449cb4 GetShortPathNameA
• 0x449cb8 GetProfileStringA
• 0x449cbc GetThreadLocale
• 0x449cc0 GetStringTypeExA
• 0x449cc4 GetFullPathNameA
• 0x449ccc FindFirstFileA
• 0x449cd0 FindClose
• 0x449cd4 DeleteFileA
• 0x449cd8 MoveFileA
• 0x449cdc SetEndOfFile
• 0x449ce0 UnlockFile
• 0x449ce4 LockFile
• 0x449ce8 FlushFileBuffers
• 0x449cec SetFilePointer
• 0x449cf0 WriteFile
• 0x449cf4 ReadFile
• 0x449cf8 CreateFileA
• 0x449cfc DuplicateHandle
• 0x449d00 SetErrorMode
• 0x449d04 GetOEMCP
• 0x449d08 GetCPInfo
• 0x449d0c SizeofResource
• 0x449d10 GetProcessVersion
• 0x449d14 GetLastError
• 0x449d24 GlobalFlags
• 0x449d28 lstrcpynA
• 0x449d2c TlsGetValue
• 0x449d30 LocalReAlloc
• 0x449d34 TlsSetValue
• 0x449d3c GlobalReAlloc
• 0x449d44 TlsFree
• 0x449d48 GlobalHandle
• 0x449d50 TlsAlloc
• 0x449d58 LocalFree
• 0x449d5c LocalAlloc
• 0x449d60 MulDiv
• 0x449d64 SetLastError
• 0x449d68 LoadLibraryA
• 0x449d6c FreeLibrary
• 0x449d70 GetVersion
• 0x449d74 lstrcatA
• 0x449d78 GlobalGetAtomNameA
• 0x449d7c GlobalAddAtomA
• 0x449d80 GlobalFindAtomA
• 0x449d84 lstrcpyA
• 0x449d88 GetModuleHandleA
• 0x449d8c GetProcAddress
• 0x449d90 MultiByteToWideChar
• 0x449d94 WideCharToMultiByte
• 0x449d98 lstrlenA
• 0x449da0 GetCurrentProcess
• 0x449da8 GlobalUnlock
• 0x449dac GlobalFree
• 0x449db0 LockResource
• 0x449db4 CreateEventA
• 0x449db8 SuspendThread
• 0x449dbc SetThreadPriority
• 0x449dc0 ResumeThread
• 0x449dc4 SetEvent
• 0x449dc8 WaitForSingleObject
• 0x449dcc CloseHandle
• 0x449dd0 GetModuleFileNameA
• 0x449dd4 GlobalLock
• 0x449dd8 GlobalAlloc
• 0x449ddc GlobalDeleteAtom
• 0x449de0 lstrcmpA
• 0x449de4 lstrcmpiA
• 0x449de8 GetCurrentThread
• 0x449dec GetCurrentThreadId
• 0x449df4 LoadLibraryExW
• 0x449df8 FindResourceA
• 0x449dfc LoadResource
• 0x449e00 GetFileType
Library USER32.dll:
• 0x449ee8 CopyRect
• 0x449eec BeginDeferWindowPos
• 0x449ef0 DeferWindowPos
• 0x449ef4 EqualRect
• 0x449ef8 ScreenToClient
• 0x449efc AdjustWindowRectEx
• 0x449f00 SetFocus
• 0x449f04 GetSysColor
• 0x449f08 MapWindowPoints
• 0x449f0c SendDlgItemMessageA
• 0x449f10 UpdateWindow
• 0x449f14 CheckDlgButton
• 0x449f18 CheckRadioButton
• 0x449f1c GetDlgItemInt
• 0x449f20 GetDlgItemTextA
• 0x449f24 SetDlgItemInt
• 0x449f28 SetDlgItemTextA
• 0x449f2c IsDlgButtonChecked
• 0x449f30 ScrollWindowEx
• 0x449f34 IsDialogMessageA
• 0x449f38 SetWindowTextA
• 0x449f3c MoveWindow
• 0x449f40 ShowWindow
• 0x449f44 wvsprintfA
• 0x449f48 LoadStringA
• 0x449f4c DestroyMenu
• 0x449f50 ClientToScreen
• 0x449f54 GetDC
• 0x449f58 ReleaseDC
• 0x449f5c GetWindowDC
• 0x449f60 BeginPaint
• 0x449f64 EndPaint
• 0x449f68 TabbedTextOutA
• 0x449f6c DrawTextA
• 0x449f70 GrayStringA
• 0x449f74 LoadCursorA
• 0x449f78 SetCapture
• 0x449f7c ReleaseCapture
• 0x449f80 WaitMessage
• 0x449f84 GetDesktopWindow
• 0x449f8c WindowFromPoint
• 0x449f90 GetClassNameA
• 0x449f94 PtInRect
• 0x449f98 InsertMenuA
• 0x449f9c DeleteMenu
• 0x449fa0 GetMenuStringA
• 0x449fa4 GetSysColorBrush
• 0x449fa8 GetDialogBaseUnits
• 0x449fac SetRectEmpty
• 0x449fb0 LoadAcceleratorsA
• 0x449fb8 LoadMenuA
• 0x449fbc SetMenu
• 0x449fc0 ReuseDDElParam
• 0x449fc4 UnpackDDElParam
• 0x449fc8 BringWindowToTop
• 0x449fcc CharUpperA
• 0x449fd0 GetScrollPos
• 0x449fd4 SetScrollPos
• 0x449fd8 GetTopWindow
• 0x449fdc IsChild
• 0x449fe0 GetCapture
• 0x449fe4 WinHelpA
• 0x449fe8 wsprintfA
• 0x449fec GetClassInfoA
• 0x449ff0 RegisterClassA
• 0x449ff4 GetMenu
• 0x449ff8 GetMenuItemCount
• 0x449ffc GetSubMenu
• 0x44a000 EndDeferWindowPos
• 0x44a004 TrackPopupMenu
• 0x44a008 SetWindowPlacement
• 0x44a010 GetWindowTextA
• 0x44a014 GetDlgCtrlID
• 0x44a018 DefWindowProcA
• 0x44a01c CreateWindowExA
• 0x44a020 GetClassLongA
• 0x44a024 SetPropA
• 0x44a028 UnhookWindowsHookEx
• 0x44a02c GetPropA
• 0x44a030 RemovePropA
• 0x44a034 GetMessageTime
• 0x44a038 GetMessagePos
• 0x44a03c GetForegroundWindow
• 0x44a040 SetForegroundWindow
• 0x44a044 GetWindow
• 0x44a048 SetWindowLongA
• 0x44a04c SetWindowPos
• 0x44a054 OffsetRect
• 0x44a058 IntersectRect
• 0x44a060 GetWindowPlacement
• 0x44a064 OemToCharA
• 0x44a068 CharToOemA
• 0x44a06c EndDialog
• 0x44a070 SetActiveWindow
• 0x44a074 IsWindow
• 0x44a07c DestroyWindow
• 0x44a080 GetDlgItem
• 0x44a088 LoadBitmapA
• 0x44a08c GetMenuState
• 0x44a090 ModifyMenuA
• 0x44a094 SetMenuItemBitmaps
• 0x44a098 CheckMenuItem
• 0x44a09c EnableMenuItem
• 0x44a0a0 GetFocus
• 0x44a0a4 GetNextDlgTabItem
• 0x44a0a8 GetMessageA
• 0x44a0ac TranslateMessage
• 0x44a0b0 DispatchMessageA
• 0x44a0b4 GetActiveWindow
• 0x44a0b8 GetKeyState
• 0x44a0bc CallNextHookEx
• 0x44a0c0 ValidateRect
• 0x44a0c4 PeekMessageA
• 0x44a0c8 GetCursorPos
• 0x44a0cc SetWindowsHookExA
• 0x44a0d0 GetParent
• 0x44a0d4 GetLastActivePopup
• 0x44a0d8 IsWindowEnabled
• 0x44a0dc GetWindowLongA
• 0x44a0e0 MessageBoxA
• 0x44a0e4 SetCursor
• 0x44a0e8 LoadIconA
• 0x44a0ec SendMessageA
• 0x44a0f0 AppendMenuA
• 0x44a0f4 GetSystemMenu
• 0x44a0f8 UnregisterClassA
• 0x44a0fc HideCaret
• 0x44a100 ShowOwnedPopups
• 0x44a104 PostQuitMessage
• 0x44a108 PostMessageA
• 0x44a10c EnableWindow
• 0x44a110 InvalidateRect
• 0x44a114 IsIconic
• 0x44a118 GetSystemMetrics
• 0x44a11c GetClientRect
• 0x44a120 DrawIcon
• 0x44a124 ScrollWindow
• 0x44a128 GetScrollInfo
• 0x44a12c SetScrollInfo
• 0x44a130 ShowScrollBar
• 0x44a134 GetScrollRange
• 0x44a138 GetMenuItemID
• 0x44a13c SetScrollRange
• 0x44a140 IsWindowVisible
• 0x44a144 IsRectEmpty
• 0x44a148 ShowCaret
• 0x44a14c ExcludeUpdateRgn
• 0x44a150 DrawFocusRect
• 0x44a154 DefDlgProcA
• 0x44a158 GetWindowRect
• 0x44a15c IsWindowUnicode
• 0x44a160 CharNextA
• 0x44a164 InflateRect
• 0x44a168 CallWindowProcA
Library GDI32.dll:
• 0x449a40 GetStockObject
• 0x449a44 SelectPalette
• 0x449a48 SetBkMode
• 0x449a4c SetPolyFillMode
• 0x449a50 SetROP2
• 0x449a54 SetStretchBltMode
• 0x449a58 SetMapMode
• 0x449a5c SetViewportOrgEx
• 0x449a60 OffsetViewportOrgEx
• 0x449a64 SetViewportExtEx
• 0x449a68 ScaleViewportExtEx
• 0x449a6c SetWindowOrgEx
• 0x449a70 OffsetWindowOrgEx
• 0x449a74 SetWindowExtEx
• 0x449a78 ScaleWindowExtEx
• 0x449a7c SelectClipRgn
• 0x449a80 ExcludeClipRect
• 0x449a84 IntersectClipRect
• 0x449a88 OffsetClipRgn
• 0x449a8c MoveToEx
• 0x449a90 LineTo
• 0x449a94 SetTextAlign
• 0x449aa0 SetMapperFlags
• 0x449aa8 ArcTo
• 0x449aac SetArcDirection
• 0x449ab0 PolyDraw
• 0x449ab4 SelectObject
• 0x449ab8 SetColorAdjustment
• 0x449abc PolyBezierTo
• 0x449ac0 DeleteObject
• 0x449ac4 GetClipRgn
• 0x449ac8 CreateRectRgn
• 0x449acc SelectClipPath
• 0x449ad0 ExtSelectClipRgn
• 0x449ad4 PlayMetaFileRecord
• 0x449ad8 GetObjectType
• 0x449adc EnumMetaFile
• 0x449ae0 PlayMetaFile
• 0x449ae4 GetDeviceCaps
• 0x449ae8 GetViewportExtEx
• 0x449aec GetWindowExtEx
• 0x449af0 CreatePen
• 0x449af4 ExtCreatePen
• 0x449af8 CreateSolidBrush
• 0x449afc CreateHatchBrush
• 0x449b00 CreatePatternBrush
• 0x449b08 PtVisible
• 0x449b0c RectVisible
• 0x449b10 TextOutA
• 0x449b14 ExtTextOutA
• 0x449b18 Escape
• 0x449b20 GetTextMetricsA
• 0x449b24 CreateFontIndirectA
• 0x449b28 RestoreDC
• 0x449b2c SaveDC
• 0x449b30 StartDocA
• 0x449b34 DeleteDC
• 0x449b38 GetObjectA
• 0x449b3c SetBkColor
• 0x449b40 SetTextColor
• 0x449b44 GetClipBox
• 0x449b48 GetDCOrgEx
• 0x449b4c PolylineTo
• 0x449b50 CreateDIBitmap
• 0x449b54 PatBlt
• 0x449b58 GetTextExtentPointA
• 0x449b5c BitBlt
• 0x449b60 CreateCompatibleDC
• 0x449b64 CreateBitmap
Library comdlg32.dll:
• 0x44a250 GetFileTitleA
Library WINSPOOL.DRV:
• 0x44a218 ClosePrinter
• 0x44a21c DocumentPropertiesA
• 0x44a220 OpenPrinterA
Library ADVAPI32.dll:
• 0x4499c0 RegSetValueExA
• 0x4499c4 RegOpenKeyA
• 0x4499c8 RegDeleteKeyA
• 0x4499cc RegDeleteValueA
• 0x4499d0 RegCloseKey
• 0x4499d4 RegQueryValueExA
• 0x4499d8 RegOpenKeyExA
• 0x4499dc RegCreateKeyExA
Library SHELL32.dll:
• 0x449ea0 DragQueryFileA
• 0x449ea4 DragFinish
• 0x449ea8 DragAcceptFiles
• 0x449eac SHBrowseForFolderA
• 0x449eb4 SHGetFileInfoA
Library COMCTL32.dll:
• 0x449a10
Library ole32.dll:
• 0x44a280 CoInitializeEx
• 0x44a284 CoGetMalloc
• 0x44a288 CoUninitialize

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49192 113.108.239.194 r1---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49193 113.108.239.196 r3---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49180 113.16.209.193 support.apple.com 443
192.168.56.101 49183 124.225.105.97 www.download.windowsupdate.com 80
192.168.56.101 49191 203.208.41.65 redirector.gvt1.com 80
192.168.56.101 49189 203.208.41.98 update.googleapis.com 443
192.168.56.101 49173 23.2.76.134 support.microsoft.com 443
192.168.56.101 49187 23.2.76.134 support.microsoft.com 443
192.168.56.101 49184 23.218.96.6 www.intel.com 443
192.168.56.101 49185 23.218.96.6 www.intel.com 443
192.168.56.101 49176 23.9.89.201 support.oracle.com 443
192.168.56.101 49177 23.9.89.201 support.oracle.com 443

UDP

Source Source Port Destination Destination Port
192.168.56.101 49713 114.114.114.114 53
192.168.56.101 50320 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 53380 114.114.114.114 53
192.168.56.101 53500 114.114.114.114 53
192.168.56.101 53661 114.114.114.114 53
192.168.56.101 57089 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 60088 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 60221 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 60966 114.114.114.114 53
192.168.56.101 62144 114.114.114.114 53
192.168.56.101 62191 114.114.114.114 53
192.168.56.101 62912 114.114.114.114 53
192.168.56.101 64118 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138

HTTP & HTTPS Requests

URI Data
http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: redirector.gvt1.com
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab 
GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1
Cache-Control: max-age = 3600
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 03 Mar 2021 06:32:16 GMT
If-None-Match: "0d8f4f3f6fd71:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: www.download.windowsupdate.com
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab 
GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1
Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 03 Mar 2021 06:32:16 GMT
If-None-Match: "0d8f4f3f6fd71:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: www.download.windowsupdate.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=33be3ccb6a911403&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619489065&mv=m 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=33be3ccb6a911403&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619489065&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619489065&mv=m&mvi=1&pl=23&shardbypass=yes 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619489065&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r1---sn-j5o7dn7e.gvt1.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.